Loading npm security reports…

silt-design-mode@0.1.22: AI-agent control-surface risk | LPM Firewall

registry / silt-design-mode / 0.1.22

silt-design-mode@0.1.22

Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the consumer project's AI-agent instructions. It adds a shared AGENTS.md block and may add Claude Code skills and a command file without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Coding agents in the project can be redirected toward package-supplied MCP tools and instructions.

Mechanism

Automatic mutation of project AI-agent control files.

Policy narrative

The package declares a postinstall script that obtains npm's initial project directory and calls installSkill automatically. installSkill first writes a managed block into AGENTS.md labelled for every agent, then may create Claude Code skills and a slash command based on a machine-level Claude directory. The injected block tells agents to use the package's MCP tools and not inspect package source. This is an unconsented install-time mutation of a broad, foreign AI-agent control surface.

AI rationale

The automatic postinstall modification of AGENTS.md and agent skill files is a concrete broad AI-agent control-surface write. Its project and non-clobber guards reduce accidental file loss but do not establish user consent for the lifecycle mutation.

Evidence

package.jsonbin/footprint/postinstall.mjsbin/footprint/agent-files.mjsskill/AGENTS-BLOCK.mdAGENTS.md.claude/skills/silt-design-mode/SKILL.md.claude/skills/silt-setup/SKILL.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/footprint/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/footprint/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/cli.mjsView file

25Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L25: */ L26: import { execFileSync, spawn } from 'node:child_process'; L27: import { randomUUID } from 'node:crypto'; L28: import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'; L29: import { createServer } from 'node:http'; L30: import { join, resolve } from 'node:path'; ... L47: * that port and fail if it is taken; a stated port is a decision, not a hint. */ L48: const EXPLICIT_PORT = process.env.DM_PORT ?? argOf('--port'); L49: const HOST = '127.0.0.1'; // loopback only — this must never listen on a network interface ... L58: /** L59: * THE ONE-SHOT VERBS, as data: which module holds each, and which function

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.mjsView on unpkg · L25

105*/ L106: const { armUpdateNotice } = await import('./silt/update-notice.mjs'); L107: await armUpdateNotice();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L105

bin/footprint/agent-files.mjsView file

75Install-time code directly mutates a foreign AI-agent control surface: L75: const COMMANDS = [ L76: { file: 'SEND-COMMAND.md', marker: '.claude', at: '.claude/commands/silt-send.md' }, L77: ]; ... L86: * training data: baseline 53%, sk[redacted] 53% (never invoked in 56% of cases), L87: * skills plus an explicit instruction 79%, an AGENTS.md pointer block 100%. Always-loaded L88: * context wins because no decision is involved. ... L100: file: 'AGENTS-BLOCK.md', L101: at: 'AGENTS.md', L102: begin: '', ... L107: * A marker pair alone is the conventional managed-block contract, and it is not enough L108: * here. Someone documenting their own AGENTS.md conventions writes our exact BEGIN and L109: * END once each, with their explanation between them — one well-ord

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/footprint/agent-files.mjsView on unpkg · L75

bin/silt/silt-binary.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/silt/silt-binary.mjs#virtual:normalized:round1View on unpkg

bin/push/mcp-push.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.18 matchedPath = bin/push/mcp-push.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/push/mcp-push.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 2-42json

2 "name": "silt-design-mode",

3 "version": "0.1.22",

4 "description": "Point at any element in a running UI, say what should change, and an agent makes the change in your source. Works standalone; Silt canvases are optional.",

5 "license": "SEE LICENSE IN LICENSE",

6 "homepage": "https://silt.app",

7 "engines": {

8 "node": "^22.18.0 || >=24.11.0"

9 },

10 "type": "module",

11 "main": "./dist/index.js",

12 "scripts": {

13 "lab": "vite",

14 "check": "tsc --noEmit",

15 "lint": "eslint src bin build lab test",

16 "build:lab": "vite build",

17 "build": "vite build -c vite.lib.config.ts && tsc -p tsconfig.build.json",

18 "test": "npm run build && node --test test/*.test.mjs",

19 "test:e2e": "playwright test",

20 "prepack": "npm run build",

21 "pack:web": "npm pack",

22 "postinstall": "node bin/footprint/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "dependencies": {

25 "@babel/parser": "^8.0.4",

26 "magicast": "^0.5.4"

27 },

28 "devDependencies": {

29 "@hugeicons/core-free-icons": "^1.1.0",

30 "@hugeicons/react": "^1.1.0",

31 "@playwright/test": "^1.62.1",

32 "@types/node": "^22.20.1",

33 "@types/react": "18.3.3",

34 "@types/react-dom": "18.3.0",

35 "@vitejs/plugin-react": "^4.3.4",

36 "dialkit": "^1.4.3",

37 "eslint": "^10.8.0",

38 "react": "18.3.1",

39 "react-dom": "18.3.1",

40 "typescript": "~5.6.3",

41 "typescript-eslint": "^8.66.0",

42 "vite": "^6.3.5"

bin/cli.mjsView file

Lines 5-45javascript

5 * whose supervision, project resolution and port scan live in start.mjs.

6 *

7 * A zero-dependency HTTP listener on LOOPBACK ONLY. The browser posts annotation batches

8 * here; this

bin/footprint/agent-files.mjsView file

Lines 55-95javascript

55 * the over-broad description this split exists to prevent.

56 */

57const DOCS = [

58 { file: 'SKILL.md', slug: 'silt-design-mode' },

59 { file: 'SETUP.md'

bin/silt/silt-binary.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/silt/silt-binary.mjs#virtual:normalized:round1View on unpkg

bin/push/mcp-push.mjsView file

•matchType = normalized_sha256 matchedPackage = silt-design-mode@0.1.18 matchedPath = bin/push/mcp-push.mjs matchedIdentity = npm:c2lsdC1kZXNpZ24tbW9kZQ:0.1.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/push/mcp-push.mjsView on unpkg

Lines 85-125javascript

85 // binary defaults to `user`, one machine-wide entry that authenticates per project.

86 mcp: { from: './silt/silt-link.mjs', call: 'cmdPassthrough' },

87 logout: { from: './silt/silt-link.mjs', call: 'cmdPassthrough' },

88 doctor: { from: './silt/silt-link.mjs', call: 'cmdPassthrough' },

89 // skills + login + MCP in one verb, for a fresh clone.

90 setup: { from: './footprint/setup.mjs', call: 'cmdSetup' },

91 // the build plugin into this repo's next/vite config — and the ONE verb that pulls

92 // magicast in, which is the whole reason none of this is imported at the top.

93 wire: { from: './footprint/build-config.mjs', call: 'cmdWire' },

94 // the inverse of `setup` + `init` + `wire`, in one verb. NOT an npm lifecycle hook:

95 // `preuninstall` never fires for npx, and pnpm blocks lifecycle scripts — see the

96 // module header.

97 uninstall: { from: './footprint/uninstall.mjs', call: 'cmdUninstall' },

98};

99

100/**

101 * ONE PLACE FOR THE UPDATE NOTICE, ahead of every verb including `start`, because a

102 * dependency that is behind is behind whatever you happened to type. It reads a stamp

103 * file and registers an exit handler — no network on this path, so no verb gets slower.

104 * See silt/update-notice.mjs for why this notifies rather than installing.

105 */

106const { armUpdateNotice } = await import('./silt/update-notice.mjs');

107await armUpdateNotice();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.mjsView on unpkg · L105

108

109/**

110 * `doctor` answers for BOTH halves, and the design-mode half goes first.

111 *

112 * The binary below reports on the Silt account, the daemon and the detected

113 * agents. It knows nothing about whether the build plugin is wired, whether a

114 * provider key is set, or which parser gates writes — the three that fail

115 * invisibly, and so the three a health command most owes an answer about.

116 *

117 * OURS PRINTS EVEN WHEN THE BINARY IS MISSING. A user with no Silt account has a

118 * working install and a real question; making them acquire a daemon to hear the

119 * answer about design mode would be backwards.

120 */

121if (cmd === 'doctor') {

122 for (const l of formatReport(await probeAll(process.cwd()))) console.log(l);

123

124 /**

125 * WHAT WE HAVE WRITTEN TO THIS MACHINE, and which of it `uninstall` can take back.